[asterisk-dev] AST-2016-007: RTP Resource Exhaustion

[Asterisk Security Team]

               Asterisk Project Security Advisory - AST-2016-007

         Product        Asterisk                                              
         Summary        RTP Resource Exhaustion                               
    Nature of Advisory  Denial of Service                                     
      Susceptibility    Remote Authenticated Sessions                         
         Severity       Moderate                                              
      Exploits Known    No                                                    
       Reported On      August 5, 2016                                        
       Reported By      Etienne Lessard                                       
        Posted On       
     Last Updated On    September 8, 2016                                     
     Advisory Contact   Joshua Colp <jcolp AT digium DOT com>                 
         CVE Name       

    Description  The overlap dialing feature in chan_sip allows chan_sip to   
                 report to a device that the number that has been dialed is   
                 incomplete and more digits are required. If this             
                 functionality is used with a device that has performed       
                 username/password authentication RTP resources are leaked.   
                 This occurs because the code fails to release the old RTP    
                 resources before allocating new ones in this scenario. If    
                 all resources are used then RTP port exhaustion will occur   
                 and no RTP sessions are able to be set up.                   

    Resolution  If overlap dialing support is not needed the “allowoverlap”   
                option can be set to no. This will stop any usage of the      
                scenario which causes the resource exhaustion.                
                                                                              
                If overlap dialing support is needed a change has been made   
                so that existing RTP resources are destroyed in this          
                scenario before allocating new resources.                     

                               Affected Versions       
                         Product                       Release  
                                                       Series   
                  Asterisk Open Source                  11.x    All Versions  
                  Asterisk Open Source                  13.x    All Versions  
                   Certified Asterisk                   11.6    All Versions  
                   Certified Asterisk                   13.8    All Versions  

                                  Corrected In
          Product                              Release                        
    Asterisk Open Source                   11.23.1, 13.11.1                   
     Certified Asterisk                11.6-cert15, 13.8-cert3                

                                    Patches
                 SVN URL                              Revision                

    Links  https://issues.asterisk.org/jira/browse/ASTERISK-26272             

    Asterisk Project Security Advisories are posted at                        
    http://www.asterisk.org/security                                          
                                                                              
    This document may be superseded by later versions; if so, the latest      
    version will be posted at                                                 
    http://downloads.digium.com/pub/security/AST-2016-007.pdf and             
    http://downloads.digium.com/pub/security/AST-2016-007.html                

                                Revision History
         Date          Editor                   Revisions Made                
    August 23, 2016  Joshua Colp  Initial creation                            

               Asterisk Project Security Advisory - AST-2016-007
               Copyright © 2016 Digium, Inc. All Rights Reserved.
  Permission is hereby granted to distribute and publish this advisory in its
                           original, unaltered form.